#BSidesPGH
Where: 116 Federal St., Sunny Pittsburgh, PA.
When: June 10, 2011
http://www.securitybsides.com/w/page/38914998/BSidesPittsburgh

#BSidesCT
Where: Meriden, Connecticut
When: June 11, 2011
http://bsidesct.eventbrite.com

eXcon
Where: Meriden, Connecticut
When: June 11-12, 2011
http://excon.eventbrite.com  (email excon@nesit.net for more info)
Begins after BSidesCT Registration cost is $50.00

#BSidesVienna
When: June 18, 2011
Where: Vienna, Austria
http://www.bsidesvienna.com
CFP now closed!

2nd Annual AIDE conference
When: July 11th – 15th, 2011
Where: Marshall University Forensic Science Center, Huntington, WV
http://aide.marshall.edu/

OISF July Anniversary Event
When: July 16th, 2011
Where: Dayton, Ohio
http://ohioinfosec.org
Adrian Will be there

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html
CFP Closed!

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)
http://www.gaissa.org
CFP open now through June 3, 2011! Email submissions to Conference@gaissa.org

EFF:
The ISD Podcast has entered entered into a contest to see who can raise the most money for the Electronic Frontier Foundation.  For those who don’t know, the EFF is a non-profit group of lawyers, policy analysts, activists, and technologists who fight for digital rights and have helped countless hackers and security researchers get out of hot water as well as exposing injustices caused by ignorant legislation and bad judgements.  Please click the following link to donate to a vitally important cause:
http://action.eff.org/site/TR/Contest/Advocacy?team_id=1730&pg=team&fr_id=1060

Stories

Source: http://www.boston.com/news/nation/washington/articles/2011/05/31/hackers_post_fake_story_on_pbs_site/

PBS officials say hackers have cracked the network’s website, posting a phony story claiming dead rapper Tupac Shakur was alive in New Zealand, and a group that claimed responsibility for the hacking complained about a recent “Frontline’’ investigative news program on WikiLeaks.

PBS confirmed early yesterday morning on its official Twitter account that the website had been hacked. The phony story had been taken down that morning. It had been posted on the site of the “PBS NewsHour’’ program, which is produced by WETA-TV in Arlington, Va.

Anne Bentley, PBS’s vice president of corporate communications, said in an e-mail that erroneous information posted on the website has been corrected. The hackers also posted login information for two internal PBS sites: one that media use to access the PBS press room and an internal communications website for stations, she said. She added all affected parties were being notified.

David Fanning, executive producer of “Frontline,’’ said he learned of the hacking early yesterday, nearly a week after the program aired its “WikiSecrets’’ documentary about the leak of US diplomatic cables to the WikiLeaks website.

The documentary, produced by WGBH-TV in Boston, generated criticism and debate on the program’s website in recent days from those sympathetic to WikiLeaks founder Julian Assange and from those who thought the program was fair, Fanning said.

“Frontline’’ producers hear impassioned responses all the time, Fanning said. Having a group attack the PBS website over a news program was unusual but “probably not unexpected,’’ he said.

“From our point of view, we just see it as a disappointing and irresponsible act, especially since we have been very open to publishing criticism of the film . . . and the film included other points of view,’’ Fanning said. “This kind of action is irresponsible and chilling.’’

PBS officials did not immediately respond to phone and e-mail messages.
A group calling itself LulzSec and “The Lulz Boat’’ on Twitter claimed responsibility and posted links to other hacks.

Source:http://www.pcworld.com/article/228823/htc_ends_locked_bootloader_policy.html

HTC has some good news for anyone who's wanted to root their Android phones: The company announced late Thursday that it will no longer be locking the bootloaders on its phones. Confirmed via a post on HTC’s Facebook page, CEO Peter Chou said that after listening to customer feedback, the company would provide unlocked bootloaders on HTC devices.
"There has been overwhelmingly customer feedback that people want access to open bootloaders on HTC phones. I want you to know that we've listened. Today, I'm confirming we will no longer be locking the bootloaders on our devices. Thanks for your passion, support and patience," Peter Chou, CEO of HTC.

As its name suggests, the bootloader loads the phone’s operating system, and having a locked bootloader means you can’t install your own or a custom operating system on your phone. Locked bootloaders, while requiring a signed certificate from HTC, don’t prevent you from rooting the phone, but still maintain manufacturer control over handsets.

It’s encouraging to hear that HTC listens to its customers’ requests for open bootloaders seriously, and that perhaps handset makers will be willing to cede more control of their devices to users in the future. This announcement likely only applies to future HTC devices, though we’ll be excited to hear if HTC will be retroactively providing unlocked bootloaders on current HTC phones.

Late last month, Motorola announced that it would introduce an unlockable bootloader for its phones later this year.

Source:  http://www.computerworld.com/s/article/9217028/Sony_says_hacker_stole_2_000_records_from_Canadian_site

The problems keep coming for Sony. On Tuesday the company confirmed that someone had hacked into its website and stolen about 2,000 customer names and e-mail addresses.

Close to 1,000 of the records have already been posted online by a hacker calling himself Idahc, who says he's a "Lebanese grey-hat hacker." Idahc found a common Web programming error, called an SQL injection flaw, that allowed him to dig up the records on the Canadian version of the Official Sony Ericsson eShop, an online store for mobile phones and accessories.

The hacker got access to records for about 2,000 customers, including their names and e-mail addresses and a hashed version of users' passwords, said Ivette Lopez Sisniega, a Sony Ericsson Mobile Communications spokeswoman. "Sony Ericsson has disabled this e-commerce website," she said in an e-mail message. "We can confirm that this is a standalone website and it is not connected to Sony Ericsson servers."

Other than the names and e-mail addresses, no personal or banking information was compromised, she said.

Source:  http://www.darkreading.com/advanced-threats/167901091/security/application-security/229625502/attackers-step-away-from-mainstream-target-lesser-known-apps.html

Microsoft has Patch Tuesday. Oracle and Adobe are on regular patch cycles, often issuing ten or more patches at once. But many smaller vendors haven't yet developed such rigorous patching processes — and that may make them prime targets for new exploits, experts say.

After years of attacking popular Microsoft file formats such as Word and Excel, attackers moved on to Adobe's PDF and Flash formats. Today, more attacks are focusing on Oracle's Java. As they became subject to more frequent attacks, software vendors strengthened their platforms to make them more difficult to assault.

But for the most part, smaller software vendors have not had to weather the scrutiny of cybercriminals and security researchers. And because of this lack of scrutiny, attackers are beginning to develop more targeted and sophisticated attacks that take advantage of flaws in less popular software that has not had as much rigorous security testing.

"At some point, [attackers] are going to exhaust all the different file formats that they can exploit," says Mike Dausin, manager of advanced security intelligence for HP TippingPoint's DVLabs. "It was only .exes at first, and then it was screen savers, and on and on down the list.
… As the holes get plugged, [attackers] will likely move on to the more exotic formats."

Source: http://news.techworld.com/security/3281833/dimension-data-finds-vulnerabilities-on-cisco-devices/

Large numbers of companies using Cisco network equipment are still vulnerable to a single security vulnerability flaw nearly two years after a patch was issued, an analysis of network scans by Dimension Data for its 2011 Network Barometer Report has found.

Overall, Dimension's Technology Lifecycle Management (TLM) assessment service discovered that an average of 73 percent of the 270 assessments it carried out on Cisco-dominated global companies had at least one known device security vulnerability that had yet to be patched. This held true for companies of all sizes and across all geographies.

Surprisingly, a single prominent vulnerability, Cisco PSIRT (Cisco Product Security Incident Response Team) 109444, was found on 66 percent of the networks looked at, accounting for much of the security exposure it found.

PSIRT 10944 has been rated by the industry Common Vulnerability Scoring System (CVSS) as being between 6.4 and 7.8 out of 10 in terms of severity (which is to say, moderately critical), and capable of allowing an attacker to hit affected devices with a successful DDoS attack, said Dimension Data.

Source:http://www.guardian.co.uk/world/2011/may/25/china-prisoners-internet-gaming-scam

As a prisoner at the Jixi labour camp, Liu Dali would slog through tough days breaking rocks and digging trenches in the open cast coalmines of north-east China. By night, he would slay demons, battle goblins and cast spells.

Liu says he was one of scores of prisoners forced to play online games to build up credits that prison guards would then trade for real money. The 54-year-old, a former prison guard who was jailed for three years in 2004 for "illegally petitioning" the central government about corruption in his hometown, reckons the operation was even more lucrative than the physical labour that prisoners were also forced to do.

"Prison bosses made more money forcing inmates to play games than they do forcing people to do manual labour," Liu told the Guardian. "There were 300 prisoners forced to play games. We worked 12-hour shifts in the camp. I heard them say they could earn 5,000-6,000rmb [£470-570] a day. We didn't see any of the money. The computers were never turned off."

Memories from his detention at Jixi re-education-through-labour camp in Heilongjiang province from 2004 still haunt Liu. As well as backbreaking mining toil, he carved chopsticks and toothpicks out of planks of wood until his hands were raw and assembled car seat covers that the prison exported to South Korea and Japan. He was also made to memorise communist literature to pay off his debt to society.

But it was the forced online gaming that was the most surreal part of his imprisonment. The hard slog may have been virtual, but the punishment for falling behind was real.

"If I couldn't complete my work quota, they would punish me physically. They would make me stand with my hands raised in the air and after I returned to my dormitory they would beat me with plastic pipes. We kept playing until we could barely see things," he said.

It is known as "gold farming", the practice of building up credits and online value through the monotonous repetition of basic tasks in online games such as World of Warcraft. The trade in virtual assets is very real, and outside the control of the games' makers. Millions of gamers around the world are prepared to pay real money for such online credits, which they can use to progress in the online games.

The trading of virtual currencies in multiplayer games has become so rampant in China that it is increasingly difficult to regulate. In April, the Sichuan provincial government in central China launched a court case against a gamer who stole credits online worth about 3000rmb.
The lack of regulations has meant that even prisoners can be exploited in this virtual world for profit.

According to figures from the China Internet Centre, nearly £1.2bn of make- believe currencies were traded in China in 2008 and the number of gamers who play to earn and trade credits are on the rise.

It is estimated that 80% of all gold farmers are in China and with the largest internet population in the world there are thought to be 100,000 full-time gold farmers in the country.

In 2009 the central government issued a directive defining how fictional currencies could be traded, making it illegal for businesses without licences to trade. But Liu, who was released from prison before 2009 believes that the practice of prisoners being forced to earn online currency in multiplayer games is still widespread.

"Many prisons across the north-east of China also forced inmates to play games. It must still be happening," he said.

"China is the factory of virtual goods," said Jin Ge, a researcher from the University of California San Diego who has been documenting the gold farming phenomenon in China. "You would see some exploitation where employers would make workers play 12 hours a day. They would have no rest through the year. These are not just problems for this industry but they are general social problems. The pay is better than what they would get for working in a factory. It's very different," said Jin.

"The buyers of virtual goods have mixed feelings … it saves them time buying online credits from China," said Jin.

The emergence of gold farming as a business in China – whether in prisons or sweatshops could raise new questions over the exporting of goods real or virtual from the country.

"Prison labour is still very widespread – it's just that goods travel a much more complex route to come to the US these days. And it is not illegal to export prison goods to Europe, said Nicole Kempton from the Laogai foundation, a Washington-based group which opposes the forced labour camp system in China.

Announcements:

Defcon CFP closes today!
https://www.defcon.org/html/defcon-19/dc-19-cfp.html

LayerOne 2011
When: Saturday May 28th – Sunday May 29th
Where: Los Angeles, CA
http://www.layerone.org/

My Hard Drive Died
5-Day Data Recovery Expert Certification
Where: Atlanta, Georgia
When: June 6-10, 2011

5-Day Bootcamp Data Recovery
Where: Chicago, Illinois
When: July 18-22, 2011

#BSidesPGH
Where: 116 Federal St., Sunny Pittsburgh, PA.
When: June 10, 2011
http://www.securitybsides.com/w/page/38914998/BSidesPittsburgh

#BSidesCT
Where: Meriden, Connecticut
When: June 11, 2011
http://bsidesct.eventbrite.com

eXcon
Where: Meriden, Connecticut
When: June 11-12, 2011
http://excon.eventbrite.com  (email excon@nesit.net for more info)
Begins after BSidesCT Registration cost is $50.00

#BSidesVienna
When: June 18, 2011
Where: Vienna, Austria
http://www.bsidesvienna.com
CFP now closed!

2nd Annual AIDE conference
When: July 11th – 15th, 2011
Where: Marshall University Forensic Science Center, Huntington, WV
http://aide.marshall.edu/

OISF July Anniversary Event
When: July 16th, 2011
Where: Dayton, Ohio
http://ohioinfosec.org
Adrian Will be there

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html
CFP Closed!

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)
http://www.gaissa.org
CFP open now through June 3, 2011! Email submissions to Conference@gaissa.org

EFF:
The ISD Podcast has entered entered into a contest to see who can raise the most money for the Electronic Frontier Foundation.  For those who don’t know, the EFF is a non-profit group of lawyers, policy analysts, activists, and technologists who fight for digital rights and have helped countless hackers and security researchers get out of hot water as well as exposing injustices caused by ignorant legislation and bad judgements.  Please click the following link to donate to a vitally important cause:
http://action.eff.org/site/TR/Contest/Advocacy?team_id=1730&pg=team&fr_id=1060

Stories

Tools:  http://www.mysecurityscanner.com
For pricing contact: info@mysecurityscanner.com or 904-639-6709

Source: http://www.notanon.com/reviews/android-privacy-inspector/2011/05/26/

We’ve all been hearing about companies and developers not respecting your privacy and siphoning off details about you to their databases.  To be fair, many of these apps are free so they have to make money somehow but they should be a bit more forthcoming about their practices.  Since we know things will only get worse though, here is a proactive solution to help you see exactly what you are sharing.  

From the product description:
“Privacy Inspector is the lite version of Privacy Blocker. Privacy Inspector reveals all your apps dirty secrets that steal your personal information. Find out what your apps don’t want you to know in seconds today!

Privacy Inspector is the only app that can fully lookout for apps that steal your private information and may be harmful. It is unlike any other app in that it can actually scan through other apps code to find privacy issues. No other app can do this on Android! This is what sets Privacy Inspector apart from other apps that claim protection.

After scanning for potential violations, Privacy Inspector will give you details about issues within your app(s). Have you ever felt uncomfortable downloading an app that needs a permission it shouldn’t have? Now find out what is inside the app and more.

Get the security you need that other apps like Anti-Virus Pro, Lookout Mobile Security, McAfee WaveSecure can’t find.

Privacy Blocker is the only way to fully protect you and stop apps from gathering your personal information. Privacy Blocker reveals all your apps dirty secrets and then safely fixes them so you can still use your apps with an assurance of full protection. Keep your device safe and your personal information secure today!”

Privacy Inspector is available in the main Android marketplace in two versions.  There is a free version that will scan all your apps and tell you the problems it finds.  That will at least allow you to decide whether the data you are leaking to them is a fair trade for use of the app.  The paid version allows you to fix/mitigate the issues that you find.  I’m not entirely sure how they do this since I haven’t used or purchased that version but I will probably check it out at a later date.

For now, I snagged the free app and scanned through a few apps.  The results were a little surprising to me.  Google Earth came up spotless for instance and the free version of Angry Birds has two issues and is rated “bad”.  The user interface is fairly attractive but I found it to be a little confusing at first.  It didn’t take long to figure it out but it could be a little more straight forward.  My other complaint is that you can only queue up 5 apps at a time to scan and the scanning process can take a few minutes per app.

I hope to see more apps like this and I can only hope that someone will produce something similar for the iOS platform (assuming Apple would allow for it).  The only problem with that is that this is exactly the type of app that nefarious individuals will be providing fake versions of.

Here is the link toPrivacy Inspector

Announcements:

Defcon CFP closes friday May 27th!
https://www.defcon.org/html/defcon-19/dc-19-cfp.html

LayerOne 2011
When: Saturday May 28th – Sunday May 29th
Where: Los Angeles, CA
http://www.layerone.org/

My Hard Drive Died
5-Day Data Recovery Expert Certification
Where: Atlanta, Georgia
When: June 6-10, 2011


5-Day Bootcamp Data Recovery
Where: Chicago, Illinois
When: July 18-22, 2011

#BSidesPGH
Where: 116 Federal St., Sunny Pittsburgh, PA.

When: June 10, 2011
http://www.securitybsides.com/w/page/38914998/BSidesPittsburgh

#BSidesCT
Where: Meriden, Connecticut

When: June 11, 2011
http://bsidesct.eventbrite.com

eXcon
Where: Meriden, Connecticut
When: June 11-12, 2011
http://excon.eventbrite.com  (email excon@nesit.net for more info)
Begins after BSidesCT Registration cost is $50.00

#BSidesVienna
When: June 18, 2011
Where: Vienna, Austria
http://www.bsidesvienna.com
CFP now closed!

2nd Annual AIDE conference
When: July 11th – 15th, 2011
Where: Marshall University Forensic Science Center, Huntington, WV
http://aide.marshall.edu/

OISF July Anniversary Event
When: July 16th, 2011
Where: Dayton, Ohio
http://ohioinfosec.org
Adrian Will be there

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html
CFP Closed!

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)

http://www.gaissa.org
CFP open now through June 3, 2011! Email submissions to Conference@gaissa.org

EFF:

The ISD Podcast has entered entered into a contest to see who can raise the most money for the Electronic Frontier Foundation.  For those who don’t know, the EFF is a non-profit group of lawyers, policy analysts, activists, and technologists who fight for digital rights and have helped countless hackers and security researchers get out of hot water as well as exposing injustices caused by ignorant legislation and bad judgements.  Please click the following link to donate to a vitally important cause:
http://action.eff.org/site/TR/Contest/Advocacy?team_id=1730&pg=team&fr_id=1060

Stories

Source: http://allthingsd.com/20110524/eat-your-cookies-eu-privacy-directive-takes-effect-wednesday/

New European Union privacy regulations that require Web sites to get consent from EU users before tracking them around the rest of the Web will go into effect Wednesday. The directive is aimed at cookies used for targeted advertising, and applies to companies operated in any country.

However, many EU countries have yet to create laws based on the directive, which was originally legislated in 2009, and it’s not clear how aggressively various governments will enforce opt-in cookies.

“Confusion and uncertainty” is how Dennis Dayman, chief privacy and security for Eloqua–a marketing automation provider that’s supplying tools to help Web sites offer data capture choices–described the situation. He noted that what makes things even harder is that requirements will vary from country to country.

“Do-Not-Track” laws, which would require options for consumers to opt out of online data collection, are also being discussed in the United States. Sen. Jay Rockefeller (D., W.Va.) this month proposed the Do-Not-Track Online Act of 2011, which would be enforced by the Federal Trade Commission if it passes.

California State Sen. Alan Lowenthal proposed a similar law in California earlier this year. Google, Facebook, AOL, Yahoo and various advertising and retail companies have submitted formal opposition to the California bill, arguing that all four major browsers already offer users options to filter their own Web use.

Source: http://www.thehackernews.com/2011/05/internet-explorer-vulnerable-to-cookie.html

A computer security researcher has found a flaw in Microsoft Corp’s widely used Internet Explorer browser that he said could let hackers steal credentials to access FaceBook, Twitter and other websites.

He calls the technique “cookiejacking.”

“Any website. Any cookie. Limit is just your imagination,” said Rosario Valotta, an independent Internet security researcher based in Italy.

Hackers can exploit the flaw to access a data file stored inside the browser known as a “cookie,” which holds the login name and password to a web account, Valotta said via email

Once a hacker has that cookie, he or she can use it to access the same site, said Valotta, who calls the technique “cookiejacking.”

The vulnerability affects all versions of Internet Explorer, including IE 9, on every version of the Windows operating system.

To exploit the flaw, the hacker must persuade the victim to drag and drop an object across the PC’s screen before the cookie can be hijacked.

That sounds like a difficult task, but Valotta said he was able to do it fairly easily. He built a puzzle that he put up on Facebook in which users are challenged to “undress” a photo of an attractive woman.

“I published this game online on FaceBook and in less than three days, more than 80 cookies were sent to my server,” he said. “And I’ve only got 150 friends.”

Microsoft said there is little risk a hacker could succeed in a real-world cookiejacking scam.

“Given the level of required user interaction, this issue is not one we consider high risk,” said Microsoft spokesman Jerry Bryant.

“In order to possibly be impacted a user must visit a malicious website, be convinced to click and drag items around the page and the attacker would need to target a cookie from the website that the user was already logged into,” Bryant said.

Source: http://www.informationweek.com/news/security/client/229625599

The majority of the world's spam-driven sales are serviced by just three banks.
That surprise finding comes from a new paper that literally "follows the money" for global spam. The paper, to be delivered at next week's IEEE Symposium on Security and Privacy 2011 in Oakland, Calif., is credited to 15 researchers from four institutions–the University of California at Berkeley, University of California at San Diego, the International Computer Science Institute, and Budapest University of Technology and Economics.

Interestingly, their research takes a different tack from most spam studies, which largely focused on how spam is distributed. Today, that's largely via botnets. "While most attention focuses on the problem of spam delivery, the email vector itself comprises only the visible portion of a large, multi-faceted business enterprise," said the researchers.

In fact, the so-called "spam value chain" involves numerous components, including not only botnets, but also domain registration, name server provisioning, hosting services, and proxy services. But spammers must also process orders, which requires "payment processing, merchant bank accounts, customer service, and fulfillment."

To see how these components work together, the researchers studied three months of real spam data, gleaned from captured botnets, spam feeds, and URLs advertised via spam–among other sources. From there, they grouped spam operations into three broad categories: counterfeit software, fake luxury goods, and pharmaceuticals. Finally, they made more than 100 purchases from spam-advertised sites, gathering further data about everything from the merchant banks they used to their and fulfillment operations.

As a result of their analysis, the researchers said that one of the principle weak links in the spam value chain is payment handling. In fact, "95% of spam-advertised pharmaceutical, replica, and software products are monetized using merchant services from just a handful of banks," they said.

All told, they saw 13 banks handling 95% of the 76 orders for which they received transaction information. (Only one U.S. bank was seen settling spam transactions: Wells Fargo.) But just three banks handled the majority of transactions: Azerigazbank in Azerbaijan, DnB NOR in Latvia (although the bank is headquartered in Norway), and St. Kitts-Nevis-Anguilla National Bank in the Caribbean. In addition, "most herbal and replica purchases cleared through the same bank in St. Kitts, … while most pharmaceutical affiliate programs used two banks (in Azerbaijan and Latvia), and software was handled entirely by two banks (in Latvia and Russia)," they said.

Surprisingly, all software orders and 85% of pharmaceutical orders used the correct Visa "Merchant Category Code," which identifies what's been sold. "A key reason for this may be the substantial fines imposed by Visa on acquirers when miscoded merchant accounts are discovered 'laundering' high-risk goods," said the researchers.

Meanwhile, orders were fulfilled from 13 suppliers in four countries: the United States–Massachusetts, Utah, and Washington, all for herbal purchases, as well as West Virginia for pharmaceuticals–plus India, China, and New Zealand. Most pharmaceuticals came from India, while most herbal products came from the United States, likely due to weak regulations, they said.

So, what's the next step? To help stop spam, the researchers suggest targeting the related payment infrastructure, since options are few and switching costs high. In particular, they suggest that U.S. issuing banks should refuse to settle "card not present" transactions for items from known-spammers, given that with a bit of undercover work, keeping tabs on said spammers doesn't appear to be too difficult. Furthermore, at least where pharmaceuticals and counterfeit software is concerned, there may already be a legal basis for blocking transactions.
"We note that a quite similar action has already occurred in restricting U.S. issuers from settling certain kinds of online gambling transactions," they said.

Some type of legal change, however, may be required to get U.S. issuing banks to comply. "Spam is actually very profitable for the banks and credit card companies that move the money. That might affect how likely they are to actually do something about this," said Mikko Hypponen, chief research officer at F-Secure, in a related blog post.

Source: http://www.itworld.com/security/168739/sony-managers-could-have-stopped-security-disasters-talking-each-other

If impersonal, multinational corporate conglomerate Sony had a process in place that got some of the key people in its IT, legal and operational divisions talking on a regular basis, it might have been able to stop the series of data breaches currently making it a laughing stock in the business and technology worlds, according to new research on risk assessment.
On April 19, Sony's PlayStation network was penetrated by what Sony Computer Entertainment boss Kaz Hirai told Congress was a "carefully planned, very professional, highly sophisticated criminal cyberattack designed to steal personal and credit card information for illegal purposes."
A week later, Sony Online Entertainment's network was hit – with a similar attack, presumably by the same crew of hackers.
Sony lost more than 25 million customer records, some including credit card numbers and other personal data.
Since then half a dozen other Sony sites have been hit, most recently a Canadian outpost from which a Lebanese "gray-hat hacker" looking more to teach Sony a lesson than profit from a hack, took customer emails and other information, and posted them as proof of the exploit.
The first breach may be understandable, but a series of breaches all using similar SQL injection techniques shows Sony just isn't paying attention.I
More charitably, Sony hasn't figured out that it would be well worth the time and money it would take to create a company-wide process to define how data should be protected, what privacy and security policies should apply to each division's IT or web sites, and what process the company should follow to both respond to one crisis and prevent future disasters at the same time, according to Larry Ponemon, founder of the Ponemon Institute for Privacy Research.
Ponemon just published a report showing only about one organization in five have policies in place that would define company-wide how to respond to crises in security or privacy. A third of companies have no policy at all.
"Most people, in most lines of business or business units keep their eye on their own responsibilities and on what they have to do," Ponemon said. "They end up in these silos where the legal team doesn't talk to IT, which doesn't talk to the business units about what to do about compliance or risk assessment. They all have their own policies, but there's a lot of duplication of effort and they don't match up."
The report was sponsored by EMC's security subsidiary RSA, but the data and conclusions seem solid enough.
The analysis process they tout suffers from its own drawbacks, though.
First it's called e-GRC – for electronic Governance, Risk Assessment and Compliance – which combines three of the five technology issues that are both critical to the success of IT in a big organization, and guaranteed to put anyone to sleep far too quickly to do anything about them. (The other two sleep-inducing critical issues both involve storage, but so far I haven't been able to stay conscious long enough to figure out which they are.)
The second problem is that it requires corporate managers to not only cooperate with each other, but to spend time and money doing it without being forced by government regulations or an immediate crisis.
"Unfortunately it usually takes a crisis to get all these people talking across organizational barriers, but once they do, they find they eliminate a lot of duplicated effort and they have a much better response time and are more effective than when they operate without a plan," Ponemon said.
Companies that have had to deal with major security crises are usually well prepared for the next one, at least until acquisitions, changes of leadership or short corporate memories makes it seem wasteful or "soft" to spend resources making sure there is a specific group of managers responsible for coordinating data-governance, security and compliance policies companywide.
A process of risk-assessment that required a team at Sony to inform other divisions that it had been breached and how, and requiring other divisions to check for and eliminate similar vulnerabilities in their own sites, would have stopped the chain of Sony disasters after the first one.
"It's still not easy," Ponemon said. "But you've got a much better chance to top the problem early, rather than having it come back time after time."

Source: http://www.crn.com/news/security/229625644/google-issues-fix-for-android-clientlogin-authentication-flaw.htm

Google is rolling out a fix for a serious ClientLogin authentication protocol vulnerability in its Android operating system that enables hackers to launch sidejacking attacks that access and steal users' personal data via the Calendar, Contacts and other Web services.

Google said it would start implementing a server-side patch last week, which will be automatically installed on Android operating systems without any user interaction.

"We're starting to roll out a fix which addresses a potential security flaw that could, under certain circumstances, allow a third party access to data available in calendar and contacts. This fix requires no action from users and will roll out globally over the next few days," Google said in a statement last week.

"The great news is that it doesn't require a software update on the Android devices themselves – meaning the fix is automatic and worldwide. Effectively this is a silent fix," said Graham Cluley, Sophos senior technology consultant, in a blog post .

The security flaw, detected earlier this month by researchers from the University of Ulm in Germany, occurred in the way that Android apps use the ClientLogin authentication feature to access any number of Google services. Security experts contend that the flaw affects at least 97 percent of Android smartphones.

During a sidejacking attack, hackers could capture authentication tokens if the authToken request is sent over an unencrypted http connection for any Google service that uses the ClientLogin protocol. Hackers could then impersonate a user to log onto numerous personal Web applications such as Google Calendar, Contacts, and Picassa as well as third party apps such as Facebook and Twitter.

The server-side fix will essentially equip Android with the more secure HTTPS protocol when connecting to the Internet. The HTTPS automatically encrypts transmitted data when users access Web services such as Google Calendar, subsequently preventing authentication tokens from being intercepted by hackers.

While Android OS users running the latest version 2.3.4 are protected against these kinds of sidejacking attacks, the vast majority are still using the vulnerable older versions of the operating system.

Thus far, no active attacks exploiting Android's ClientLogin authentication flaw have been detected in the wild.

Source: http://www.infowars.com/financial-terrorism-tsa-holds-texas-flights-hostage/

From the not-infosec-but-interesting-anyways file comes this story about how the TSA get’s their way because they are holding all the cards and the house always wins:

An astounding Department of Justice threat to cancel airline flights to and from Texas, in addition to underhanded lobbying by TSA representatives, has killed efforts in the state to pass HB 1937, a bill that would have made invasive pat downs by TSA agents a felony.

HB 1937, a bill that would have made it “A criminal act for security personnel to touch a person’s private areas without probable cause as a condition of travel or as a condition of entry into a public place,” was headed for an imminent Senate vote in Texas having already passed the House unanimously 138-0, before the federal government stepped in to nix the legislation.

In a letter sent to Texas lawmakers, including to Lt. Gov. David Dewhurst, Speaker Joe Straus, the House Clerk, and the Senate Secretary, U.S. Attorney John E. Murphy threatened to cripple the airline industry in the state if legislators did not back down.

“If HB 1937 were enacted, the federal government would likely seek an emergency stay of the statute,” Murphy wrote. “Unless or until such a stay were granted, TSA would likely be required to cancel any flight or series of flights for which it could not ensure the safety of passengers and crew.”

“We urge that you consider the ramifications of this bill before casting your vote,” Murphy added.
The fact that Murphy can’t even get the name of the bill correct is almost as disconcerting as the rampant mafia-like attitude of the DOJ in using de facto economic terrorism to shoot down the legislation.

Following a fiery debate in the Texas House last night, Senate sponsor Dan Patrick (R-Houston) pulled the bill, remarking that TSA representatives had been “lobbying” the Texas Senate in an effort to mothball the legislation.

“I will pull HB 1937 down, but I will stand for Liberty in the state of Texas,” Patrick said.
Patrick added that TSA officials had warned him passing the bill “could close down all the airports in Texas,” which he regarded as a ‘heavy handed threat’ by the federal government.
The staff of Rep. David Simpson said the DOJ had “thrown down the gauntlet” in using such stark language to oppose the bill.

“Either Texas backs off and continues to let government employees fondle innocent women, children and men as a condition of travel,” the staff wrote, “or the TSA [Transportation Safety Administration] has the authority to cancel flights or series of flights.”

“… 97 percent of people who go though the nation’s airports do not go through these offensive searches. And yet, a United States Attorney warns that flights to Texas could be shut down because TSA would not be able to ensure the safety of passengers and crew if agents could not touch genitals. Someone must make a stand against the atrocities of our government agents …”
In a point by point refutation of the DOJ letter, Simpson compared the battle against the TSA to the Texas revolutionary war against Mexico, writing, “Gentlemen, we find ourselves at such a watershed moment today. The federal government is attempting to deprive the citizens of Texas of their constitutional rights under the Fourth Amendment of the United States Constitution and Article 1, Section 9, of the Texas Constitution. If we do not stand up for our citizens in the face of this depravation of their personal rights and dignity, who will?”

The fact that the Department of Justice and the TSA have resorted to threats of economic terrorism in addition to underhanded lobbying techniques again illustrates the fact that the federal government is increasingly behaving like a criminal enterprise with total disregard for the Constitution.

The TSA’s initial response to HB 1937 was to claim that it could not become law because it violated the Supremacy Clause of the U.S. Constitution (Article. VI. Clause 2), a law that the TSA claimed “prevents states from regulating the federal government.”
In reality, this was a complete fabrication.

“The statement is false. Ignorance from the TSA is unlikely, so I’ll call a spade a spade. They’re lying. The supremacy clause says nothing of the sort,” reported Michael Boldin of the Tenth Amendment Center.

Here’s the full text:
This Constitution, and the Laws of the United States which shall be made in pursuance thereof; and all treaties made, or which shall be made, under the authority of the United States, shall be the supreme law of the land; and the judges in every state shall be bound thereby, anything in the constitution or laws of any state to the contrary notwithstanding.

“So, in simple terms, what does the supremacy clause mean? Just what it says. The constitution is supreme. And any federal laws made in line with the constitution is supreme. Nothing more, nothing less,” writes Boldin.

As we have documented, TSA grope downs and body scans are now being rolled out on highways, street corners, public buildings, at sports events, and even at local prom nights.

Despite the fact that the federal government has resorted to thuggish intimidation tactics to kill the anti-grope down bill in Texas, this only marks the latest chapter in an epic states’ rights battle that has centered on the agenda of the TSA to become a literal occupying force in America, manning internal checkpoints that will litter the entire country.

Defcon CFP closes friday May 27th!
https://www.defcon.org/html/defcon-19/dc-19-cfp.html

LayerOne 2011
When: Saturday May 28th – Sunday May 29th
Where: Los Angeles, CA
http://www.layerone.org/

My Hard Drive Died
5-Day Data Recovery Expert Certification
Where: Atlanta, Georgia
When: June 6-10, 2011

5-Day Bootcamp Data Recovery
Where: Chicago, Illinois
When: July 18-22, 2011

#BSidesPGH
Where: 116 Federal St., Sunny Pittsburgh, PA.
When: June 10, 2011
http://www.securitybsides.com/w/page/38914998/BSidesPittsburgh

#BSidesCT
Where: Meriden, Connecticut
When: June 11, 2011
http://bsidesct.eventbrite.com

eXcon
Where: Meriden, Connecticut
When: June 11-12, 2011
http://excon.eventbrite.com  (email excon@nesit.net for more info)
Begins after BSidesCT Registration cost is $50.00

#BSidesVienna
When: June 18, 2011
Where: Vienna, Austria
http://www.bsidesvienna.com
CFP now closed!

2nd Annual AIDE conference
When: July 11th – 15th, 2011
Where: Marshall University Forensic Science Center, Huntington, WV
http://aide.marshall.edu/

OISF July Anniversary Event
When: July 16th, 2011
Where: Dayton, Ohio
http://ohioinfosec.org
Adrian Will be there

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html
CFP Closed!

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)
http://www.gaissa.org
CFP open now through June 3, 2011! Email submissions to Conference@gaissa.org

EFF:
The ISD Podcast has entered entered into a contest to see who can raise the most money for the Electronic Frontier Foundation.  For those who don’t know, the EFF is a non-profit group of lawyers, policy analysts, activists, and technologists who fight for digital rights and have helped countless hackers and security researchers get out of hot water as well as exposing injustices caused by ignorant legislation and bad judgements.  Please click the following link to donate to a vitally important cause:
http://action.eff.org/site/TR/Contest/Advocacy?team_id=1730&pg=team&fr_id=1060

Stories
Source: Geordy’s email

Sony proactively announced that they will be offering identity theft protection through Debix.  Being that my credit card was already expired and Debix is someone I’ve never heard of, I’m not going to bother with it.  I tend to wonder what the security posture is over at Debix since associating themselves with Sony will undoubtedly make them a target as well.

I’m also baffled as to how Sony can offer this on top of the rest of their “welcome back” package.  Debix must have worked one hell of a deal because Sony only thinks the hack will cost them $1.70 per record.  After they spent the money rebuilding their infrastructure(not to mention all the other costs), there really can’t be that much left in the coffers for Debix.

Here is the email I received from Sony:

Identity Theft Protection Offer for PlayStation®Network and Qriocity™ Customers

Sony Computer Entertainment and Sony Network Entertainment have made arrangements with Debix to offer AllClear ID PLUS to eligible PlayStation®Network and Qriocity account holders in the United States who are concerned about identity theft.

AllClear ID PLUS is a premium identity protection service that uses advanced technology to deliver alerts to help protect you from identity theft. The service also provides identity theft insurance coverage and hands-on help from expert fraud investigators.

Sony has arranged, at no charge to eligible PlayStation®Network and Qriocity account holders, for twelve months of this service to be provided by Debix to those who choose to enroll. In order to be eligible, account holders must be residents of the United States with active accounts as of April 20, 2011.

If interested, please submit your email address by June 28, 2011, at 11:59:59 PM CST at: us.playstation.com/news/consumeralerts/identity-theft-protection.

Please note, you must enter the same email address used to register your PlayStation®Network or Qriocity account. Once your email address is validated, you will be sent your AllClear ID PLUS activation code.

Source:http://blogs.forbes.com/kashmirhill/2011/05/24/five-not-totally-unfeasible-ways-that-the-state-of-privacy-could-be-worse/

People have been declaring privacy dead for years. Decades, even. Privacy must be a vampire that keeps avoiding the stake straight to the heart — dead yet undead.

We certainly are more exposed today than in years past because of new methods of surveillance with advances in technology and the Gossipmonger on steroids that is the Internet. But the privacy vampire is still creeping around. It could be worse, and probably will be. Here are five things that will act as sunlight to further kill the poor creature.

Facial recognition everywhere. We’re already getting little tastes of facial recognition on services like Facebook and Picasa, which use it to help us tag photos of our friends. But what if it leapt out of social networks and into the real world? When Google first launched image searching app Goggles in 2009, it could have incorporated facial recognition allowing users to search for anyone’s identity after taking a photo of them, but decided it was too invasive a feature. The company has repeatedly made clear that it considers facial recognition to be too creepy. “We have the technology — lots of people have the technology, and some companies are already doing it,” Google privacy director Alma Whitten has said. “But we don’t know how we can build in transparency and control over it.” (Yet.)

Suspected criminals aren’t subject to the same privacy concerns. Massachusetts police officers already have a $3,000 iPhone app for checking the identities of criminal suspects by snapping a photo of them. Privacy scholar Jeff Rosen imagines a 2025 with Facebook broadcasting a constant live stream of video from ubiquitous cameras around the world, with facial recognition to tell you who’s doing what. There was a time when something like Google Street View seemed implausible. How improbable is People Street View?

RFID chips in everything. IBM scientist and privacy thinker Jeff Jonas made this prediction back in 2007. He predicts that the radio-frequency tracking chips will be so cheap that they’ll be in everything: “objects of all sizes and shapes embedded with these little transmitters, each announcing what they are to nearby receivers… your car, keys, sunglasses, prescription bottles and underwear [and] everything else ranging from your dinner plates to your casino chips.” The benefit for businesses is that goods are easier to track, and RFID-ed groceries mean faster check-out lines for consumers, and RFID-ed keys and eyeglasses mean never losing those things again. The downside is that everything you own becomes as trackable as your clicks on the Internet.

A hotel which wants to stay anonymous is happily employing this technology in its bathrobes and towels, notes Popular Science. Reuters reports that the hotel’s Hawaii property reduced its theft of pool towels from 4,000 a month to 750 since it started using the washable chips from Linen Tracking Technology, saving it $16,000. Unclear whether they chase the towels back to the Midwest or not.

Your car tattles on you when you break road rules. There’s already a thriving speed and red light camera industry on the roads. Road safety camera company Redflex is monitoring speeds and red light running in 255 cities in 23 states. But what if the monitoring jumped inside your car? Insurance company State Farm slyly offered drivers an iPhone app “to grade their driving habits” (though said it wouldn’t collect the info or base rates on it).

Meanwhile, Danish police wisely realized that lots of drivers already have tracking devices in their cars in the form of navigation devices. After they bought data from GPS company TomTom to determine where speed traps and speeding cameras should be placed, TomTom’s users flipped out leading to an emphatic apology from the company (though no damage to its bottom line).

Everyone’s DNA is on file. My DNA is already on file. I sent it along to 23andMe to find out what the company could tell me about my genetic profile (My parents should have made me wear sunblock when I was a kid; my genes put me at an increased risk of skin cancer). The company’s database is growing fast. When I spoke to them in the fall, they had over 40,000 people’s genetic information. Now that number is over 75,000. And the database is not exempt from law enforcement searches.

Not everyone is putting their DNA on file willingly. Convicted criminals are forced to do it in many states, as are newborn babies. Hospitals take blood from newborns to run genetic screens for diseases. In many states, there are no regulations when it comes to keeping that blood “on file.” The Pediatrics Journal recently did a survey of state laws when it comes to keeping babies’ blood on file. In two states (Utah and Washington), the blood becomes the property of the state. In two other states (California and Maine), it’s government property unless parents object in writing. Many states have no regulation at all when it comes to what’s done with the blood, how it can be repurposed, or how long it’s kept. And it may not be something most parents are thinking about during the first few days of their newborn’s life.

People can comment on you and rate you in real time. What if you walked around with a virtual Facebook wall that people could write on? There may come a time when our identities will be discoverable via phone, the same way you can use OpenTable or Yelp to find a restaurant. And we’ll come with reviews. Here’s thefunny version of this future.  In the real world, this is starting to happen on the roads. Bump is “a social network for your license plate” – fellow drivers can rate your driving performance. Less anonymity on the roads may make your fellow drivers less likely to cut you off for fear of what it will do to their insurance rates. There are some serious benefits to a world with less privacy.

Source: http://arstechnica.com/apple/news/2011/05/russian-company-releases-commercial-ios-decryption-toolset.ars

The first commercially available set of tools for cracking the encryption and passwords on iOS devices has been made available by Russian security company ElcomSoft. One part of their software is a password breaker, while another part, available only to law enforcement and forensic agencies, is able to extract numbers used to create the encryption keys for iOS data to render decrypted images of the device.

The decryption tool requires access to the device in question, but once it's in hand, a few different kinds of keys need can be scraped from it, including the unique device key (UID) and escrow keys calculated using the UID and escrow pairing records. If the device is only protected by a 4-digit passcode, the program then only needs to brute-force its way through that to get access to all of the decryptable information.

iOS was never much of a security fortress (as we've noted numerous times) and even this new tool uses a variation of a previously discovered method. Charlie Miller, of Pwn2Own fame and a principal research consultant with Accuvant, even pointed out to Ars that the Fraunhofer Institute for Secure Information Technology detailed a very similar method in a research paper they put out in February. However, their tools are not for sale.

If your phone or tablet regularly comes under scrutiny of the law, Miller adds that this commercially available toolset is fairly simple to route by using a long, complex password rather than a 4-digit code to protect your data. The ElcomSoft method comes with a password breaker, but much of its efficiency is derived from defining limits on the possible guesses, such as variations on a certain word.

While "beating it out of you" will remain the superior method of password obtainment for the average law enforcer, the password breaker could still come in handy for when you can't remember which characters in your leetspeak password were numbers, and which were letters.

Source:http://news.cnet.com/8301-27076_3-20065881-248.html

Apple this afternoon posted instructions for removing MacDefender, the rogue antivirus software that targets Mac OS X users. Additionally the company has said it will be updating its Mac OS to automatically find and remove the software.

Apple support articleHT4650, titled "how to avoid or remove Mac Defender malware" includes a description of the software, as well as steps to remove it. CNET has learned that those who come to Apple for support on the issue will be directed toward the article until the fix is delivered, which Apple says should arrive "in the coming days."

News of MacDefender, which is also known as Mac Security and Mac Protector, hit earlier this month. The fake antivirus program is designed to trick users into thinking their machine has various malware infections, which it can remove if you pay up with a credit card.

As for how widespread the issue has become, Apple has not said. A post earlier today by ZDnet's Ed Bott estimated it to be anywhere between 60,000 and 125,000 customers, based on information gathered from a source at one of Apple's support centers. That post also contained a purported memo sent to Apple call centers, wherein they were told to point affected users toward a support document explaining what malware is and to install antivirus software.

The question about whether it's Apple's responsibility to aid users with the removal of malware as part of its AppleCase support service is still of interest for any future malware issues. From Apple's own description of what is offered in terms of "software support," there are things like "using the Mac OS X operating system," "quick how-to questions about iLife and iWork," and "connecting to printers and AirPort networks." That is to say, there's nothing about removing software programs, even if that could technically be considered general use of the Mac OS. Nonetheless, it remains in the company's interest to secure its OS from software that can threaten customer information, as this one was targeting.

Geordy’s comments: This sounds like a game of virus whack-a-mole.  They are rolling out a patch to detect and remove it?  Are they going to start doing that 4+ times per day like other legitimate AV vendors when the viruses become commonplace.  Whatever they are doing, they better grow a pair and take an actual stance instead of the silience/play dumb method that has apparently worked for them in the past.

Source:http://www.securityweek.com/chinese-android-users-experience-most-mobile-attacks

According to a report released byNetQin Mobile, users in China fell victim to about 64% of the world's mobile attacks on Android devices in the first quarter of 2011.

According to NetQin’s numbers, about 2.53 million Android users were infected with mobile malware in the first quarter of 2011, with China taking the lead with the most infections, followed by the U.S. with 7.6%, followed by Russia, India, and Indonesia respectively with 6.1%, 3.4% and 3.2%.

The reports suggests that the high number of affected users in China is partly due to the easy availability of "white box" phones (open phones that are not tied to particular carriers) and a general lack of mobile security awareness among mobile phone users. "White box" phones often run outdated versions of mobile software and are not provided with security support from legal carriers.

Also something to consider– NetQin is a China based company with a large customer base in China which could skew data somewhat. The company did have an IPO on May 5, 2011 and trades under the symbol “NQ” on the New York Stock Exchange.

A report released by Juniper Networks earlier this month showed a significant rise in threats to mobile devices, and highlighted a record number of mobile security threats, including a 400 percent increase in malware targeting the Android operating system.

Much debate has taken place in the industry regarding app store security and, specifically, how applications—many times created by amateur developers—should be examined, policed, and monitored.

The lack of mobile security awareness further adds fuel to the flames, says NetQin, as users often ignore protective measures when engaged in mobile activities, such as using mobile payment channels, web browsing or clicking on URLs from unknown sources, thus allowing more mobile viruses and malware to intrude their mobile devices.

In the consumer pool sampled by NetQin, the reported results of these mobile threats mainly include: malicious fee deduction (up to more than 45%), privacy theft (about 30%), Backdoor (about 12%), fee consumption (about 7%), rogueware (about 5%) and malware that disrupts normal operation of systems (about 1%). NetQin reports that Android Market is the main source of mobile threats, and is responsible for 57% of them. Other sources include unbranded devices and downloading from WAP and WWW websites. NetQin says most of the infected phones are running Froyo, the Android OS V2.2, accounting for 45% of the total, followed by Eclair (Android OS V2.1) and Gingerbread (Android OS V2.3) respectively with 34% and 16%. The popularity of Froyo devices is probably to blame for its becoming the main target of mobile attacks. Android OS V1.6 and previous versions are affected rarely, accounting for less than 5%.

Geordy’s comments: Odd that Google is all but blocked in China yet Android phones seem to be incredibly popular.  Wonder how they cloud-sync ‘em…

Source:  Honda CA Owner

My Hard Drive Died
5-Day Data Recovery Expert Certification
Where: Atlanta, Georgia
When: June 6-10, 2011

5-Day Bootcamp Data Recovery
Where: Chicago, Illinois
When: July 18-22, 2011

#BSidesPGH
Where: 116 Federal St., Sunny Pittsburgh, PA.
When: June 10, 2011
http://www.securitybsides.com/w/page/38914998/BSidesPittsburgh

#BSidesCT
Where: Meriden, Connecticut
When: June 11, 2011
http://bsidesct.eventbrite.com

eXcon
Where: Meriden, Connecticut
When: June 11-12, 2011
http://excon.eventbrite.com  (email excon@nesit.net for more info)
Begins after BSidesCT Registration cost is $50.00

#BSidesVienna
When: June 18, 2011
Where: Vienna, Austria
http://www.bsidesvienna.com
CFP now closed!

2nd Annual AIDE conference
When: July 11th – 15th, 2011
Where: Marshall University Forensic Science Center, Huntington, WV
http://aide.marshall.edu/

OISF July Anniversary Event
When: July 16th, 2011
Where: Dayton, Ohio
http://ohioinfosec.org
Adrian Will be there

#BruCon
When: Sept 19-22, 2011
Where: Brussels, Belgium
http://blog.brucon.org/2011/02/confirmation-of-brucon-dates.html
CFP Closed!

@DerbyCon
When: September 30th – October 2, 2011
Where: Louisville, KY
http://www.derbycon.com/

2011 Fall Information Security Conference
When:  November 8 – 9, 2011
Where: Atlanta, GA (Loudermilk Conference Center)
http://www.gaissa.org
CFP open now through June 3, 2011! Email submissions to Conference@gaissa.org

EFF:
The ISD Podcast has entered entered into a contest to see who can raise the most money for the Electronic Frontier Foundation.  For those who don’t know, the EFF is a non-profit group of lawyers, policy analysts, activists, and technologists who fight for digital rights and have helped countless hackers and security researchers get out of hot water as well as exposing injustices caused by ignorant legislation and bad judgements.  Please click the following link to donate to a vitally important cause:
http://action.eff.org/site/TR/Contest/Advocacy?team_id=1730&pg=team&fr_id=1060

Stories

Tools:  NetGlub Serial Update!
If you are using NetGlub  and have experienced an issue with running more than 50 transforms per day, change your serial to 2222-4567-89ab-cdef.

The default serial needs to be replaced with 2222-4567-89ab-cdef to change to "commercial_level1" group which isn't limited.  You should notice that you will no longer be using the community1 username, but the corresponding commercial1 username.

The next generation of Netglub will have GPU/CPU huge graph real-time layouting in 2D/3D with OpenGL for render and OpenCL for layout. Keep in mind that according to the authors, NetGlub 1.0 was just a PoC to show it's possible to do the same than Maltego.  Look for some more exciting announcements as we get them.

Source: http://news.softpedia.com/news/Brazilian-Banking-Malware-Packs-64-Bit-Rootkit-201870.shtml

A new piece of Brazilian banking malware capable of spoofing SSL-protected sites has been fitted with a rootkit component able to infect 64-bit Windows systems.

According to security researchers from antivirus vendor Kaspersky Lab, the malware was distributed through a drive-by download attack launched from a popular compromised Brazilian website.

The attack used a rogue Java applet that exploited vulnerabilities in older versions of Java Runtime Environment (JRE).

Successful exploitation dropped several files on the victim's computer including aaa.bat, add.reg, bcedit.exe, cert_override.txt, plusdriver.sys and plusdriver64.sys.

The bat file launches the infection process by first loading the contents of the add.reg into the registry.

This disables the User Access Control (UAC) feature in Windows and adds a fake CA to the list of Certification Authorities trusted by the computer.

The bat then uses bcdedit.exe to modify several Windows boot options including "DISABLE_INTEGRITY_CHECKS", "TESTSIGNING ON" and "type= kernel start= boot error= normal."

These options have the purpose of disabling certain checks so that plusdriver.sys or plusdriver64.sys, depending on the system, can be loaded on the next reboot.

These rootkit components modify the Windows HOSTS file to hardcode a rogue DNS entry for an online banking website that points to a server under the attackers' control.

This will cause visitors to be redirected to a phishing version of the signed with a SSL certificate signed by the rogue CA and trusted by the system.

The malware also disables a browser security plugin commonly distributed to customers by Brazilian banks. According to Kaspersky's Fabio Assolini, the CA installation trick is not new with Brazilian banking malware, but the use of 64-bit infecting rootkits is.

This suggests an increasing sophistication for local fraud operations. To avoid falling victims to such attacks users are strongly advised to keep their computer software up to date.

Source:http://gcn.com/articles/2011/05/20/cybereye-zeus-trojan-returns.aspx

Source code for the venerable and sophisticated ZeuS Trojan malware became available free on the Internet recently after having been leaked. Or was it leaked? At least one researcher thinks it could have been released intentionally as freeware as part of a marketing ploy to create demand for peripheral code and services.

So far that isn’t certain, said Bradley Anstis, vice president of technical strategy for M86 Security. “There is no hard evidence for any of the theories that have come out,” he said.

But the model is not a new one for legitimate software. The VMware hypervisor is available for a free download, for example, and the company makes money on selling support and other tools. There haven’t been examples of this model for malware yet, Anstis said, but in recent years the underground market for malicious code, services and ill-gotten gain has paralleled the legitimate software and services market.

This could mean that the ZeuS malware, already implicated in the theft of tens of millions of dollars from banks, could become even more prevalent on the Web.

ZeuS, also known as Zeus, Zbot, Wsnspem and Gorthax and recently affiliated with SpyEye, was first identified in 2007 and has evolved to become one of the most sophisticated Trojans, specializing in the theft of bank account information. Its botnets contain millions of compromised computers, and the FBI last year arrested more than 100 “mules” who were being used to launder and move money that had been stolen from bank accounts via ZeuS.

ZeuS crimeware kits were reported selling online for from $700 to $15,000. Then, early in May, it was reported that the source code was in the open. Peter Kruse, partner at the Danish security firm CSIS, said in a blog post that the code was being distributed on several online sites.

“We even compiled it in our lab and it works like a charm,” Kruse wrote. “We can hereby confirm that the complete … source code is freely available for inspection, inspiration or perhaps to be compiled and used in future attacks.”

Anstis said the free availability is likely to make ZeuS the default malware code for developing new attacks, which could in turn create a larger market for add-on services that the developers could profit from.

Marketers of crimeware already sell services, including support and maintenance, and ZeuS is no exception. Websites already are commonly offering webinjects for ZeuS and SpyEye to help users tailor their attacks against specific targets. Ready-to-use injects for U.S. targets available on one site include eBay, PayPal, Verizon Wireless, Valley National Bank, Bank of America, Chase and American Express.

“We can develope [sic] webinjects to your needs if you provide logins for testing it,” the site says. “Injects can be made on for any country and any language if you provide details for it. All injects are tested on accounts before selling.”

The market for these products, as well as for support and maintenance contracts, is likely to grow if ZeuS becomes even more popular with the bad guys. Reducing the cost of entry from $15,000 to zero could attract not only lots of new customers, but also customers with fewer skills who are more likely to need add-ons and support.

“It could be a really smart move,” Anstis said.

In the end, it might not matter a lot whether the release of the ZeuS code was intentional, but it is disturbing to think that the bad guys are using our own business models against us.

Source:http://www.theregister.co.uk/2011/05/23/microsoft_yahoo_captchas_busted/

Computer scientists have developed software that easily defeats audio CAPTCHAs offered on account registration pages of a half-dozen popular websites by exploiting inherent weaknesses in the automated tests designed to prevent fraud.

Decaptcha is a two-phase audio-CAPTCHA solver that correctly breaks the puzzles with a 41-percent to 89-percent success rate on sites including eBay, Yahoo, Digg, Authorize.net, and Microsoft's Live.com. The program works by removing background noise from the audio files, allowing only the spoken characters needed to complete the test to remain.

In virtually all of the tests, Decaptcha was able to correctly solve the puzzle at least once in every 100 attempts, making the technique suitable for botmasters with large armies of compromised computers. The high success rate was largely the result of the ease in removing sound distortions known as background noise, intermediate noise, and constant noise inserted into the background to throw off speech-recognition programs. Most audio-based CAPTHA systems are wide open to the attack with the notable exception of the Google-owned Recaptcha.net, which uses a different approach known as semantic noise.

"Our results indicate that non-continuous audio captcha schemes built using current methods (without semantic noise) are inherently insecure," the scientists wrote in a recently published research paper. "As a result, we suspect that it may not be possible to design secure audio captchas that are usable by humans using current methods. It is therefore important to explore alternative approaches."

Decaptcha uses a supervised algorithm that must be trained for each CAPTCHA scheme being targeted. Training requires feeding a set of puzzles with their answers into the program. Eventually, Decaptcha was able to identify the sound shapes in the underlying audio file by comparing them to a large sample of sounds already cataloged. The researchers generated 4.2 million audio CAPTCHAs.

The paper is only the latest reminder of the flaws in CAPTCHAs, which are designed to prevent scripts from registering email accounts, and carrying out other automated attacks, by presenting the user with a problem that's hard for computers to solve. Real-world attacks against audio-CAPTCHAs from Microsoft have already been used by the Pushdo spam botnet to create fraudulent email accounts on Live.com. More traditional CAPTCHAs, which require a user to recognize a word buried in a distorted image, have been successfully defeated for years, with one of the more recent examples being an optical character recognition attack on Google.
After attacks come to light, website operators typically make changes that block specific technique. Researchers then revise their attacks, requiring more changes to be made in the targeted CAPTCHA schemes.

The latest research suggests web developers may have to make permanent changes to the audio CAPTCHAs, which are offered for visually impaired users.

"Our experiments with commercial and synthetic captchas indicate that the present methodology for building audio captchas may not be rectifiable," they wrote. "Besides Recaptcha, all of the commercial schemes we tested used combinations of constant and regular noise as distortions. All in all, computers may actually be more resilient than humans to constant and regular noise so any schemes that rely on these distortions will be inherently insecure."

Source:http://www.phoronix.com/scan.php?page=news_item&px=OTQ3Ng

On the kernel mailing list, Linus Torvalds has recently voicedhis desire to end the Linux 2.6 kernel series and move future releases to the Linux 2.8 or even Linux 3.0 series. While efforts to change the Linux kernel versioning have been voiced in the past and ultimately failed, it looks like the effort this time around is building momentum and the change could very well happen.

What seems to be the latest idea expressed by Linus and carried by other kernel developers would involve bumping the kernel version to Linux 3.0 for the next release (what would have been Linux 2.6.40 or some other release in the near future) and then succeeding kernel releases would be tagged as Linux 3.1, 3.2, 3.3, etc. The third version number (e.g. Linux 3.0.1) would denote the stable point release. The versions wouldn't consist of both even and odd numbers.

Obviously then at some point in the future it will raise the question about bumping to be the Linux 4.0 kernel. Linus already notes in a few years time he'd probably look at declaring the Linux 4.0 kernel around the time of Linux 3.40, but this "Linux 3" isn't simply to denote the Linux kernel now entering its third decade of development.

There's some still interested though in having the Linux kernel version be date/time oriented, like was proposed by Greg KH in 2008, but he's on board with any change, including this Linux kernel 3.x naming proposal.

Some developers and users also don't see a need to change from the current Linux 2.6.xx versioning, but overall there's more people that seem positive about the effort this time around. With the blessing of Linus, this is likely to take place.

There's also some that would have liked to see the Linux kernel versioning change upon the BKL (Big Kernel Lock) having been removed, but that's already after the fact now (that milestone was hit in Linux 2.6.37). Another developer has proposed that Linux 3.0 not be tagged until the ARM architecture code has been cleaned-up, but so far that proposal doesn't have any following.

There's even now some developers submitting their merge window pull requests as being for Linux v3.0-rc1 in hopes of this fundamental change going through and being done for this 2.6.40 development cycle that's already under-way.

Source: http://www.kold.com/story/14702242/special-report

Security hackers have discovered a potentially dangerous loophole in airline security.
You cannot board a plane without a boarding pass, but computer hackers have found a way around that.

Instead of the standard boarding passes, majority of all passengers are now coming to the airport armed with boarding passes they printed out on a computer at home.

It is an important document that gets them through TSA check-points, and on board a plane.  Using a simple Photoshop program, security hackers have figured out a way to mess with the document, and fool security.

By downloading the airline boarding pass into a .PDF file, they import into the Photoshop program, the hacker is able to change the name on the boarding pass to their own.
Then, all they need is an ID and the fake boarding pass, and they're airborne.

The paper boarding passes do have a bar code on them that is scanned at the second check-point by an airline agent, right before you board the plane.  But, they do not check your ID and match it with the name that comes up on their computer.

At the first check point, a TSA agent does check your ID and your boarding pass to match the names, but they do not scan the bar code, so there's no way for them to tell if the boarding pass was actually issued in your name.

It is a problem TSA officials say they have been aware of for at least the last four years.
Every passenger sitting on board these planes has been through security. But how closely have they been screened?

"It's a little scary that anyone can do it," said frequent flyer Patrick Green.
Despite TSA's acknowledgement that boarding pass generating programs do exist, Green expressed concern.

"You can still do it.  Nobody's made any changes for it."

A Memphis woman recently made it through the TSA security check-point after accidentally grabbing her husband's boarding pass.  A TSA official apparently missed the fact that the woman's boarding pass had the name "Edward" printed on it.

They blamed it on a lax agent, who was disciplined.

Frequent flyer Don Stidham said the solutions seemed simple, and wondered why TSA had not changed the way they operated.

"Something needs to be done on the front-end computer side where this is being done to block this. There has to be more screening when people print these boarding passes and do something they shouldn't do," said Stidham.

Simple solutions would include locking the data, like banks do, preventing .PDF files from being altered once they are issued from the airline.  Just like you cannot download banking documents into a .PDF file and download them into another program, some experts suggest doing the same with airline boarding passes that you print out.

Another solution would be to add a scanner to the first security checkpoint that is in sync with the "No Fly" list.

Why hasn't this been done? Critics say the cost would run in the billions.

In 2008, TSA acknowledged the problem on a blog stating: "We're not naive enough to say the system is foolproof. We've seen the 'boarding pass generator' web sites and know how to use Photoshop.  The broader point is accurate, we could be better on this issue. Some months ago, a team of people at TSA went to work on it."

Frequent flyers like Don Stidham want the peace of mind, but he also hopes that increased security doesn't come at the cost of the convenience, of being able to print his boarding pass at home.

"You hate to have a few rotten apples screw it up for everybody else," said Stidham.
TSA requested bids last month, to purchase a computer system to identify fake IDs and board passes.

Instead of boarding passes like this.. Most of us are printing them at home .. it's a very important piece of paper.. But using Photoshop hackers have figured out a way to mess with this document.. and fool security.

TSA officials have known about this for years.. But the questions is.. Have they actually done anything about it?